Skip to content

Infrastructure for mails.wdes.eu

License

Notifications You must be signed in to change notification settings

wdes/mails.wdes.eu

Repository files navigation

Emails

Our Docker-Mailserver infra.

Nice tools to use to validate the infra

DANE (TSLA records)

Generate

Use https://ssl-tools.net/tlsa-generator

Our CA is https://ssl-tools.net/subjects/082e3ff9058cfe8a7c18bd13efdf1d1660707a6b Download PEM and put in the generator Use full cert and SHA2-256. SHA2-512 is not recommended by the mailhardener article. Since it is the CA use: DANE-TA: Trust Anchor Assertion. The values (0) PKIX-TA (1) PKIX-EE should not be used with SMTP.

Use PORT 25 !

Test the generated value:

  • openssl s_client -brief -dane_tlsa_domain mx1.mails.example.org -dane_tlsa_rrdata "2 0 1 21acc1dbd6944f9ac18c782cb5c328d6c2821c6b63731fa3b8987f5625de8a0d" -connect mx1.mails.example.org:465 <<< "Q"
  • Alter the hash to check that it fails.

TODO

Interesting documentations